‼ CVE-2021-43054 ‼
📖 Read
via "National Vulnerability Database".
The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34704 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43971 ‼
📖 Read
via "National Vulnerability Database".
A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitrary SQL commands via the filterText parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43052 ‼
📖 Read
via "National Vulnerability Database".
The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows authentication bypass due to a hard coded secret used in the default realm server of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.7.2 and below, TIBCO FTL - Developer Edition: versions 6.7.2 and below, and TIBCO FTL - Enterprise Edition: versions 6.7.2 and below.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43972 ‼
📖 Read
via "National Vulnerability Database".
An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to copy arbitrary files on the server filesystem to the web root (with an arbitrary filename) via the tempFile and fileName parameters in the HTTP POST body.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-1573 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to improper input validation when parsing HTTPS requests. An attacker could exploit this vulnerability by sending a malicious HTTPS request to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43055 ‼
📖 Read
via "National Vulnerability Database".
The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.📖 Read
via "National Vulnerability Database".
♟️ ‘Wormable’ Flaw Leads January 2022 Patch Tuesday ♟️
📖 Read
via "Krebs on Security".
Microsoft today released updates to plug nearly 120 security holes in Windows and supported software. Six of the vulnerabilities were publicly detailed already, potentially giving attackers a head start in figuring out how to exploit them in unpatched systems. More concerning, Microsoft warns that one of the flaws fixed this month is "wormable," meaning no human interaction would be required for an attack to spread from one vulnerable Windows box to another.📖 Read
via "Krebs on Security".
Krebsonsecurity
‘Wormable’ Flaw Leads January 2022 Patch Tuesday
Microsoft today released updates to plug nearly 120 security holes in Windows and supported software. Six of the vulnerabilities were publicly detailed already, potentially giving attackers a head start in figuring out how to exploit them in unpatched systems.…
🕴 Cloud Apps Replace Web as Source for Most Malware Downloads 🕴
📖 Read
via "Dark Reading".
Two-thirds of all malware distributed to enterprise networks last year originated from cloud apps such as Google Drive, OneDrive, and numerous other cloud apps, new research shows.📖 Read
via "Dark Reading".
Dark Reading
Cloud Apps Replace Web as Source for Most Malware Downloads
Two-thirds of all malware distributed to enterprise networks last year originated from cloud apps such as Google Drive, OneDrive, and numerous other cloud apps, new research shows.
📢 FBI warns of hackers mailing malicious USB sticks to businesses 📢
📖 Read
via "ITPro".
The FIN7 cyber crime group is alleged to be behind the months-long wave of attacks against the defence, transportation, and insurance industries📖 Read
via "ITPro".
IT PRO
FBI warns of hackers mailing malicious USB sticks to businesses | IT PRO
The FIN7 cyber crime group is alleged to be behind the months-long wave of attacks against the defence, transportation, and insurance industries
‼ CVE-2022-21897 ‼
📖 Read
via "National Vulnerability Database".
Windows Common Log File System Driver Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21916.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21842 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Word Remote Code Execution Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21902 ‼
📖 Read
via "National Vulnerability Database".
Windows DWM Core Library Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21852, CVE-2022-21896.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21895 ‼
📖 Read
via "National Vulnerability Database".
Windows User Profile Service Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21919.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21864 ‼
📖 Read
via "National Vulnerability Database".
Windows UI Immersive Server API Elevation of Privilege Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21912 ‼
📖 Read
via "National Vulnerability Database".
DirectX Graphics Kernel Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21898.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21919 ‼
📖 Read
via "National Vulnerability Database".
Windows User Profile Service Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21895.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21904 ‼
📖 Read
via "National Vulnerability Database".
Windows GDI Information Disclosure Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21848 ‼
📖 Read
via "National Vulnerability Database".
Windows IKE Extension Denial of Service Vulnerability. This CVE ID is unique from CVE-2022-21843, CVE-2022-21883, CVE-2022-21889, CVE-2022-21890.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21873 ‼
📖 Read
via "National Vulnerability Database".
Tile Data Repository Elevation of Privilege Vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21913 ‼
📖 Read
via "National Vulnerability Database".
Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass.📖 Read
via "National Vulnerability Database".